openid / sharedsignals

OpenID Shared Signals Working Group Repository
45 stars 11 forks source link

Supply 'aud' in the stream creation POST request #30

Open FragLegs opened 1 year ago

FragLegs commented 1 year ago

I am proposing that, when creating a new stream, the receiver should pass the aud value, instead of assuming the transmitter already knows it.

This issue is specifically tied to the work being done in Issue #4 and PR #9. Prior to PR #9, a stream was created by default when the transmitter/receiver relationship was established. The mechanism by which that relationship is created is not described in the SSE spec, but it involved sharing some information between the receiver and the transmitter. Specifically, the transmitter and receiver must both know the bearer token used for authenticating requests and the aud value that is added to all events in the stream.

With PR #9 in place, there is no default stream in place between a receiver and a transmitter. Instead, a receiver creates streams by calling the configuration_endpoint [POST] endpoint. The receiver must have a bearer token in order to call that endpoint, so some out-of-band communication is still required, but we could reduce the amount of out-of-band information passing by having the aud parameter be a part of the information sent in that POST call.

timcappalli commented 1 year ago

on 2023-03-21 call: @timcappalli to think about before next call

independentid commented 10 months ago

My use cases require that iss and aud be specifiable by the requesting SSF client.

For example, there may be multiple aud in use at a transmitter. How would the transmitter know which audience the receiver wants?

tulshi commented 4 months ago

I don't know if we can work on this now that ID-2 has shipped. I'd like to know everyone's thoughts here.